Teamtailor and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. Teamtailor says it will not use or share customer data processed in an AI system for its own or third-party purposes such as training; beta tests and feedback you submit are the only exceptions, and even then no model is trained. OpenAI (Co-pilot provider) is also committed not to train on it.

Vendor's wording: “Teamtailor will not use or share customer data processed in an AI System for our or third-party purposes, such as training or development.”

Source: support.teamtailor.com4. No Use For Own PurposesSecond source: support.teamtailor.comChecked on 19 October 2026

Customer chooses the region in Settings > Company > General > Data processing: Europe (Ireland, AWS), North America (Oregon, AWS) or Asia-Pacific (Australia, AWS). No default is stated.

Vendor's wording: “It's always up to you, as our customer, to choose in which region you want to have the personal data processed and stored.”

Source: support.teamtailor.comDifferent regions for data processingChecked on 19 October 2026

EU hosting available.

Yes. Choose the Europe (Ireland) region: data is mainly stored with AWS Ireland and processed mainly inside the EU/EEA. Some optional sub-processors process elsewhere (for example Twilio SMS in the USA).

Vendor's wording: “the personal data will mainly be stored with AWS Ireland and processed mainly inside the EU/EEA.”

Source: support.teamtailor.comEurope (Ireland)Checked on 19 October 2026

DPA in the terms.

Yes. The DPA is part of the customer agreement, applies automatically and prevails on personal-data questions; Teamtailor is processor.

Vendor's wording: “This DPA is part of and subject to the terms of the Agreement.”

Source: teamtailor.comData Processing Agreement: About and summaryChecked on 19 October 2026

Published.

Yes, a public list per region; EU region at https://support.teamtailor.com/en/articles/4723968: 17 rows (16 companies; AWS appears twice). AI-related: OpenAI Ireland Ltd (Co-pilot), AssemblyAI (meeting transcription), Hyperdoc/Recall (recording). NA and APAC lists are separate.

Vendor's wording: “Below is a list of the sub-processors engaged by the Teamtailor group for processing personal data on behalf of Teamtailor’s customers using our EU Region.”

Source: support.teamtailor.comList of subprocessors for customers using Teamtailor’s Europe (EU) RegionChecked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Teamtailor AB, Stockholm)

Vendor's wording: “we are referring to Teamtailor AB, Östgötagatan 16, 11621 Stockholm, Sweden”

Source: teamtailor.com1. Who is TeamtailorChecked on 19 October 2026

The customer sets retention: automatic deletion rules (Settings > Data & Privacy), for example inactive for 90 days, then removed after a one-week grace period. Deleted data stays in backups about 10 days. After contract end, all data is deleted within 60 days.

Vendor's wording: “If Customer Personal Data is deleted in the application, it is immediately deleted from your account and only maintained in our backups. Our backups are generally retained for ten (10) days.”

Source: teamtailor.comAppendix: data retentionChecked on 19 October 2026

3 named: ISO 27001, ISO 27701, SOC 2 Type 2 (audited annually).

Vendor's wording: “Teamtailor is ISO 27001 and 27701 certified, and we are also audited to the SOC 2 Type 2 standard annually.”

Source: support.teamtailor.comSecurity overviewChecked on 19 October 2026

Yes. Co-pilot is an opt-in add-on that only Company Admins can activate; admins choose which tasks it supports and can disable it at any time.

Vendor's wording: “only Company Admins can activate it. This is in order to facilitate an active decision-making process when beginning to use the feature, and to ensure that you can disable it at any time.”

Source: support.teamtailor.comIntro and Optional featureChecked on 19 October 2026